# Reissue, revoke and renew

> Reissue a certificate with a new key or approver, revoke it, and renew it before it expires.

## Reissue and revoke

### POST /api/v1/ssls/reissue

Re-issues an active certificate with a new key pair or a new approver. Free on most packages. **The validity period is not extended.**

**When you need this**

- The private key was lost or compromised.
- The server is being rebuilt and the key cannot be recovered.
- The approver e-mail address needs changing.

**Request — let us generate a new key**

```json
{
  "domainName": "apiname.com"
}
```

**Request — bring your own new CSR**

```json
{
  "domainName": "apiname.com",
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----",
  "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
  "approverMail": "webmaster@apiname.com"
}
```

**Response — 200, when you omitted the CSR**

```json
{
  "success": true,
  "message": "Reissue request submitted",
  "certificateId": "5e8c2a71-4b93-4f06-ae25-1d7f9c3b8042",
  "status": "WaitingForValidation",
  "dcvDetails": "{\"MD5\":\"...\",\"SHA1\":\"...\",\"UniqueValue\":\"...\"}",
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICvDCCAaQCAQAwdzEL...\n-----END CERTIFICATE REQUEST-----",
  "privateKey": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhki...\n-----END PRIVATE KEY-----"
}
```

:::danger[Save `csr` and `privateKey` from this response immediately]
This is the **only** time these are returned. There is no way to fetch the generated private key again, and the reissued certificate cannot be installed without it. If you lose it you must reissue again.

If you send your own `csr`, these two fields come back `null` — the key stays with you, which is the safer option.
:::

After reissuing you go through validation again: publish the new `dcvDetails` record or have the approver click the new e-mail, then poll `check-status`.

**Errors**

| Code | Meaning and fix |
| --- | --- |
| `Ssl:10026` | No certificate for this domain. |
| `Ssl:10006` | Reissue is not supported for this certificate. |
| `Ssl:10008` | The certificate must be `Active`. You cannot reissue one that is still validating. |
| `Ssl:10055` | The subscription has ended. Reissue is not possible — buy a new certificate. |
| `Ssl:10075` | This package is managed by our technical team. Open a support ticket. |
| `Ssl:10007` | The CA failed to process the reissue. Retry, or open a ticket. |
| `Ssl:10004 / Ssl:10040` | Your supplied CSR is invalid or its name does not match. |

### DELETE /api/v1/ssls/revoke

Revokes the certificate. Its status becomes `Cancelled`.

**Request**

```json
{
  "domainName": "apiname.com"
}
```

:::danger[This is not a refund, and it is not reversible]
Revoking a configured certificate does **not** return the fee. The only automatic refund is letting the 7-day configuration window lapse on a refundable package.

Once revoked, the certificate is permanently distrusted by browsers. You cannot un-revoke it — a new purchase is required. Only revoke when the private key is known to be compromised.
:::

**Errors**

| Code | Meaning and fix |
| --- | --- |
| `Ssl:10026` | No certificate for this domain. |
| `Ssl:10027` | The status does not allow revoking — already cancelled, or not yet configured. |
| `Ssl:10049` | The revoke failed. **Note:** this code is shared with a CA connectivity error — read the message to tell which. |
| `Ssl:10075` | Package managed by our technical team. Open a support ticket. |

## Renewal

There is no renewal endpoint. Renewal is a fresh purchase cycle inside the renewal window:

1. `GET /api/v1/ssls/certificate` — read `subscription.expiresAt`.
2. Within **30 days** of that date, `POST /api/v1/ssls/initialize` with the same domain. You are charged for a new one-year subscription.
3. `PUT /api/v1/ssls/configure` — the new year begins **here**, not at the old expiry.
4. The old certificate's status becomes `Renewed`. It stays technically valid until its own expiry, so there is no gap.

:::caution[Do not renew early]
Remaining days are not carried over. Renewing 30 days before expiry and configuring immediately loses those 30 days. Renew within the window but close to expiry — around 7 to 14 days before is a good balance between safety and value.
:::

| Code | Meaning and fix |
| --- | --- |
| `Ssl:10057` | Too early. The message tells you the date renewal opens. |
| `Ssl:10058` | Already renewed — the renewal is in your certificate list. |
| `Ssl:10059` | Not renewable. Only configured, non-cancelled certificates can be renewed. |